CroatiaRulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access Rules
Pravilnik o načinu obrade zdravstvenih i drugih osobnih podataka u zdravstvenim nacionalnim i institucionalnim informacijskim sustavima u… zdravstvu (Narodne novine 150/2024), čl. 6-10
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- If you operate or build a system that stores or processes health or other personal data in a Croatian national or institutional health information system, process the data with appropriate security and confidentiality and apply pseudonymization, encryption, restoration and regular testing measures (Rulebook Articles 6 and 7).
- Allow access only to users on the basis of user roles, authentication and authorization, keep audit records of all activity in the system, and require strong passwords of at least 16 characters (Article 8).
- Make backups at suitable intervals, test them regularly, and keep them on equipment and at a location different from the primary storage (Article 8).
- If you are a software provider in these systems, keep the personal data you learn permanently confidential and take the technical and organizational measures needed to secure confidentiality, integrity and availability (Article 9, paragraphs 2 and 3).
- If you use a health information system, identify and authenticate with an identification digital certificate or another credential of substantial assurance level, and do not let anyone else use it (Article 10, paragraphs 1 and 2).
What this law does
Health and other personal data must be processed so as to ensure appropriate security and confidentiality, including protection against unauthorized or unlawful processing and accidental loss, destruction or damage, by appropriate organizational, technical and security measures.
The systems that store and process the data must contain technical and organizational measures consistent with the cybersecurity rules, in particular pseudonymization and encryption, lasting confidentiality, integrity, availability and resilience, timely restoration of availability and regular testing of the measures. Article 8 makes it mandatory to allow access only to users on the basis of user roles, authentication and authorization, with audit records for all activity in the system.
Article 8 also makes it mandatory to use strong passwords of at least 16 characters combining upper and lower case letters, digits and punctuation marks. Article 8 requires backups at suitable intervals, regular testing of the backups, and backups made on equipment and at a location different from the primary storage. Software providers must keep the personal data they learn in their work permanently confidential, without time limit, even after they stop working in the systems.
A user of a health information system must identify and authenticate with an identification digital certificate or another credential of substantial assurance level.
When LexLint raises it
When your app profile says your app handles health records.